62c8b0b02dcd3e8159e6b22a95de398a9cb59d7bd1249152498b291bbaee732b

Resubmissions

21-05-2024 15:12

21-05-2024 15:11

max time kernel
360s
max time network
368s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:11

Target

S2 XP/vorbis.dll
Size

632KB
MD5

7b36cf17ec2215b4700843ef3e334bb7
SHA1

81c7785225b5030dbf1686f563b0ef116a823feb
SHA256

c277eb99d7b1cf0ba93460c7eb9770f82510fb0da011046c0d5db655311a690d
SHA512

88163a4b8464f234c39bded3eb6d7c718031ad32861814def85ce9bc240d0b181849af660fe7779443db9e9a56d8be3e5f6332a73812c2071115aefc61057986
SSDEEP

6144:f3lHZGIGVTR0gnqouNruVRJ/RbM4YkuYFSIfhwymmGhsMuT8IBDp6VNM9gKutRJW:KIGnNn5z86LpIHVVFRcKcQhOYoxE0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2356 1432 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2356	1432	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1704 wrote to memory of 1432	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1432	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1432	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1432	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1432	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1432	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1432	1704	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2356	1432	rundll32.exe	WerFault.exe
PID 1432 wrote to memory of 2356	1432	rundll32.exe	WerFault.exe
PID 1432 wrote to memory of 2356	1432	rundll32.exe	WerFault.exe
PID 1432 wrote to memory of 2356	1432	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\S2 XP\vorbis.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\S2 XP\vorbis.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 224
    3⤵
    - Program crash
    PID:2356